Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

allow heapster clusterrole to see deployments #48357

Merged
merged 1 commit into from
Jul 1, 2017
Merged

allow heapster clusterrole to see deployments #48357

merged 1 commit into from
Jul 1, 2017

Conversation

faraazkhan
Copy link
Contributor

@faraazkhan faraazkhan commented Jun 30, 2017 •
edited
Loading

What this PR does / why we need it:

Currently the default system:heapster ClusterRole does not allow access to the deployment.extensions. This limits metric collection and results in DENY messages in the kube-api logs like these:

[kube-apiserver-ip-10-0-10-12.us-west-2.compute.internal] I0630 19:22:16.088301       1 rbac.go:87] RBAC DENY: user "system:serviceaccount:kube-system:heapster" groups [system:serviceaccounts system:serviceaccounts:kube-system system:authenticated] cannot "get" resource "deployments.extensions" named "heapster-v1.4.0" in namespace "kube-system"

Which issue this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close that issue when PR gets merged): fixes # kubernetes-retired/heapster#1710

Special notes for your reviewer: NONE

Release note:

Allow the system:heapster ClusterRole read access to deployments

@k8s-ci-robot k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Jun 30, 2017
@k8s-ci-robot
Copy link
Contributor

Hi @faraazkhan. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@k8s-ci-robot k8s-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Jun 30, 2017
@k8s-github-robot k8s-github-robot added size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. release-note Denotes a PR that will be considered when it comes time to generate release notes. labels Jun 30, 2017
@ericchiang
Copy link
Contributor

Thanks for the fix.

Is there an associated issue on https://github.com/kubernetes/heapster? All I see is #48357 which just binds it to this role. If they're going to bind to this, I'd expect the heapster team to update this role as heapster requires new privileges.

@faraazkhan
Copy link
Contributor Author

faraazkhan commented Jun 30, 2017 •
edited
Loading

@ericchiang I did not create an issue with heapster, if that is the right thing to do here, I can go do it now. But the issue isn't so much with heapster, like you said, it is simply binding to this role, we just need the role updated.

@liggitt
Copy link
Member

liggitt commented Jun 30, 2017

/lgtm

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jun 30, 2017
@k8s-github-robot
Copy link

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: faraazkhan, liggitt

No associated issue. Update pull-request body to add a reference to an issue, or get approval with /approve no-issue

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these OWNERS Files:

You can indicate your approval by writing /approve in a comment
You can cancel your approval by writing /approve cancel in a comment

@ericchiang
Copy link
Contributor

/ok-to-test

@k8s-ci-robot k8s-ci-robot removed the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Jun 30, 2017
@faraazkhan faraazkhan mentioned this pull request Jun 30, 2017
Closed
@faraazkhan
Copy link
Contributor Author

Created kubernetes-retired/heapster#1710 for the sake of completeness.

@k8s-github-robot k8s-github-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jun 30, 2017
@k8s-github-robot
Copy link

Automatic merge from submit-queue (batch tested with PRs 48317, 48313, 48351, 48357, 48115)

@k8s-github-robot k8s-github-robot merged commit 3634262 into kubernetes:master Jul 1, 2017
@buddyledungarees buddyledungarees mentioned this pull request Dec 4, 2017
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees

@liggitt liggitt

@ericchiang ericchiang

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. lgtm "Looks good to me", indicates that a PR is ready to be merged. release-note Denotes a PR that will be considered when it comes time to generate release notes. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@faraazkhan @k8s-ci-robot @ericchiang @liggitt @k8s-github-robot